[windows2000] Security Event ID 560

  • From: "Schneider, Robert" <Robert.Schneider@xxxxxxxx>
  • To: windows2000@xxxxxxxxxxxxx
  • Date: Tue, 2 Aug 2005 15:00:36 -0400

 A system has the Security Event logs filling up with Event ID 560s!  100s
are written with the same time stamp. The user involved has restricted
privileges. Has anyone had this problem that can help resolve this issue.
What Is the Accesses list telling us? Could this be an Audit configuration
in GPO?
The screenshot is a sample. 
Bob Schneider 
L3 Communications/ILEX Systems 
IAVA Support 
732-530-8444 x3503 
mailto:robert.schneider@xxxxxxxx <mailto:robert.schneider@xxxxxxxx> 

Attachment: image001.png
Description: PNG image

Attachment: image002.jpg
Description: JPEG image

Other related posts: